Archive::Zip can be used by email scanning software (like amavisd-new)
to uncompress attachments before virus scanning. By modifying the
uncompressed size of archived files in the global header of the ZIP
file, it is possible to fool Archive::Zip into thinking some files
inside the archive have zero length.

Impact

An attacker could send a carefully crafted ZIP archive containing a
virus file and evade detection on some email virus-scanning software
relying on Archive::Zip for decompression.